When doing a "rpm -V" on an installed package that owns files in /tmp
or /var/tmp, rpmv crashes. This is rpm-4.4.1-21 on FC4.
The crash also leaves rpmdb locked, and the usual rm /var/lib/rpm/__db* helps.
This seems to be a pathological case, as it seems to happen only with /tmp
and /var/tmp, but a crash is a crash...

I also see that I posted mismatching specfile (package "test4") and backtraces
(from "rpm -V test"), that was the result of trying to minimize the case and
losing track of the "generations" while at it. Sorry about that. Anyway, the
attached specfile in comment 1 can still be used to reproduce the crash here.

Thanks for reproducer and tracebacks, I have a patch that I'm testing will be in
rawhide 4.4.2-4. This is in the fedora matchpathcon selinux impl not in
upstream rpm, basically unchecked path.
If you can test I'll try and get a fix to FC4.